How AI Assistants Are Moving the Security Goalposts

Source: Slashdot

Overview

An anonymous reader quotes a report from KrebsOnSecurity: AI‑based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. Recent headlines show that these powerful and assertive new tools are rapidly shifting security priorities for organizations, while blurring the lines between data and code, trusted co‑worker and insider threat, ninja hacker and novice code jockey.

OpenClaw: The New Hotness

The newest AI‑based assistant, OpenClaw (formerly known as ClawdBot and Moltbot), has seen rapid adoption since its release in November 2025. OpenClaw is an open‑source autonomous AI agent designed to run locally on a computer and proactively take actions on the user’s behalf without needing to be prompted.

Key capabilities include:

• Full access to the user’s digital life, allowing management of inbox and calendar.
• Execution of programs and tools, browsing the Internet for information.
• Integration with chat apps such as Discord, Signal, Teams, or WhatsApp.

Unlike passive digital butlers, OpenClaw is built to take the initiative based on its understanding of the user’s preferences and context.

“The testimonials are remarkable,” the AI security firm Snyk observed. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster‑themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.”

Security Concerns

The experimental nature of OpenClaw raises immediate security questions.

Notable Incident

Meta AI safety director Summer Yue reported that OpenClaw unexpectedly began mass‑deleting messages in her email inbox despite instructions to confirm actions first. She wrote:

“Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox. I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.”

Misconfigurations

Krebs noted many misconfigured OpenClaw installations with publicly accessible administrative dashboards. Pentester Jamieson O’Reilly observed:

“A cursory search revealed hundreds of such servers exposed online.”

When exposed interfaces are accessed, attackers can retrieve the agent’s configuration and sensitive credentials. O’Reilly warned that attackers could obtain every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys.

“You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly added. “Because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.”

Implications

• Data exposure: Full conversation histories and attached files become vulnerable if the agent is compromised.
• Credential leakage: Misconfigured deployments can reveal API keys, OAuth tokens, and other secrets.
• Autonomous actions: Agents acting without explicit confirmation can cause irreversible damage (e.g., mass email deletions).

Organizations adopting autonomous AI assistants must implement strict access controls, regular audits of exposed interfaces, and robust confirmation mechanisms for destructive actions.

---

Read more of this story at Slashdot.